Job Description
Responsibilities
\n
Lead the design and optimization of Splunk dashboards, alerts, correlation searches, and data ingestion for security and network observability
\n
Collaborate with network and Extra Hop teams to integrate flow data, traffic patterns, and anomalies into actionable Splunk detections
\n
Support development of network baseline visualizations and identify deviations using correlated log and traffic data
\n
Tune log sources and ingestion pipelines to improve performance, reduce false positives, and enhance signal fidelity
\n
Develop and manage Splunk content related to firewalls, VPNs, proxies, routers, switches, and endpoint devices
\n
Work with analysts to interpret detection triggers in context of network flows, packet captures, and behavior anomalies
\n
Configure and maintain Splunk components including apps, indexes, forwarders, and CIM data models
\n
Produce documentation, runbooks, and training for SOC teams and technical stakeholders
\n
Operate in both connected and disconnected environments; support secure enclave deployments of Splunk
\n
Mentor junior engineers and analysts in SPL, dashboarding, and detection development
\n
Other duties as assigned
\n
\n
Qualifications
\n
\n
Bachelor's degree in a related field OR
\n
Associates degree with an additional 2+ years of relevant IT experience OR
\n
High school diploma or GED equivalent with an additional 4+ years of directly related IT experience in lieu of degree
\n
12+ years of cybersecurity or network engineering experience with 3+ years of Splunk engineering and content development
\n
Hands-on experience with Splunk Enterprise and Enterprise Security (ES) in air-gapped or mission-secure environments
\n
Must hold a current DoD 8140 (or 8570) baseline certification at the IAT Level II or higher (e.g., CompTIA Security+)
\n
U.S. Citizen with active TS/SCI clearance.
\n
\n
Knowledge, Skills and Abilities:
\n
\n
Expert-level Splunk SPL development and content creation
\n
Strong understanding of TCP/IP, packet structures, and network traffic analysis
\n
Familiarity with Extra Hop, SolarWinds, and PCAP-based threat identification
\n
Ability to correlate multi-source logs with behavioral and network data to create high-fidelity detections
\n
Experience tuning and normalizing data to align with Splunk CIM and ES frameworks
\n
Proficiency with regex, lookup tables, macros, and dashboard visualizations
\n
Excellent documentation and mentoring skills
\n
Comfortable working across cyber, networking, and threat teams to improve detection and visibility